Arp usage. Protocols ARP, RARP, IP, ICMP
TCP/IP does not consider link and physical layer technologies; during actual data transfer, you still have to map the IP address to the link layer address.
An Ethernet network uses IP and MAC addresses to identify the source and destination of information. Information sent from one computer to another over a network contains the sender's physical address, the sender's IP address, the recipient's physical address, and the recipient's IP address. ARP provides communication between these two addresses because the two addresses are not related to each other in any way.
ARP— Address Resolution Protocol is a protocol of the third (network) layer of the OSI model, used to convert IP addresses to MAC addresses, and plays an important function in multiple access networks. ARP was defined by RFC 826 in 1982.
Direct communication between an IP address and a MAC address is carried out using so-called ARP tables, where each line indicates the correspondence of the IP address to the MAC address.
An example of an ARP table in Windows OS is shown in the figure.
In the ARP table, in addition to the IP and MAC address, the type of connection is also indicated; there are two types of entries:
- Static entries are created manually and last as long as the computer or router remains turned on.
- Dynamic records must be updated periodically. If a record has not been updated within a certain time (approximately 2 minutes), then it is excluded from the table. The ARP table does not contain entries about all network nodes. But only those who actively participate in network operations. This storage method is called an ARP cache.
In IPv6, ARP functionality is provided by the protocol NDP(Neighbor Discovery Protocol).
RARP(English: Reverse Address Resolution Protocol) is a protocol of the third (network) layer of the OSI model, performs reverse address mapping, that is, converts the hardware address into an IP address.
There are four types of ARP messages:
- ARP request(ARPrequest);
- ARP reply;
- RARP-request;
- RARP-reply.
- Hardware type (HTYPE) Each channel data transfer protocol has its own number, which is stored in this field. For example, Ethernet is number 0x0001
- Protocol type (PTYPE) Network protocol code. For example, for IPv4 it will be written 0x0800
- Hardware length (HLEN) Length of the physical address in bytes. Ethernet addresses are 6 bytes long.
- Protocol length (PLEN) Length of the logical address in bytes. IPv4 addresses are 4 bytes long.
- Operation Sender's operation code: 1 in case of request and 2 in case of response.
- Sender hardware address (SHA) The physical address of the sender.
- Sender protocol address (SPA) Logical address of the sender.
- Targethardwareaddress (THA) The recipient's physical address. The field is empty when requested.
- Target protocol address (TPA) Logical destination address.
Let's look at the structure of the ARP request header using the example of an intercepted packet using the Wireshark network analyzer
Let's look at the structure of the ARP response header (reply) using the example of an intercepted packet using the Wireshark network analyzer
You may also be interested in:
|
Command Line Utility ARP.EXE used to display and modify IP to physical (MAC) address conversion tables used by the Address Resolution Protocol (ARP). ARP -s inet_addr eth_addr ARP -d inet_addr ARP -a [-N if_addr] [-v] -a Displays current ARP entries by querying for current protocol data. If inet_addr is specified, then the IP and physical addresses only for the specified computer will be displayed. ARP familyIf ARPs are used on more than one network interface, then entries for each table will be displayed. -g Same as -a option. -v Displays current ARP entries in verbose logging mode. All invalid entries and entries in the feedback interface will be displayed. inet_addr Defines the IP address. -N if_addr Displays ARP entries for the network interface specified in if_addr. -d Removes the node specified by inet_addr. The inet_addr parameter can contain the wildcard * to remove all nodes. -s Adds a node and associates the Internet address inet_addr with the physical address eth_addr. The physical address is specified as 6 bytes (in hexadecimal), separated by a hyphen. This connection is permanent eth_addr Defines a physical address. if_addr If specified, it specifies the address of the Internet interface whose address translation table should change. If the parameter is not specified, the first available interface will be used. In IP networks, there are three ways to send packets from a source to a destination: - unicast transmission ( Unicast); - broadcast ( Broadcast); In unicast transmission, the data stream is transferred from the sending node to the individual IP address of the receiving node. Broadcasting involves delivering a stream of data from a source node to multiple recipient nodes connected to a given local network segment using a broadcast IP address. Multicast delivers a stream of data to a group of nodes at the IP address of the multicast group. The nodes of the group can be located in this local network or in any other. Nodes for multicast distribution are combined into groups using the protocol IGMP(Internet Group Management Protocol, Internet Group Management Protocol). Packets containing a group address in the destination header field will arrive at group nodes and be processed. The multicast traffic source directs multicast packets not to the individual IP addresses of each of the recipient nodes, but to the multicast IP address. Multicast addresses define an arbitrary group of IP nodes that have joined this group and wish to receive traffic addressed to it. The Internet Assigned Numbers Authority (IANA), which governs the assignment of multicast addresses, has allocated Class D IPv4 addresses in the range 224.0.0.0 to 239.255.255.255 for multicast. Examples of using ARP:arp -a— display a table of correspondence between IP and MAC addresses for this computer. arp -a | more— the same as in the previous case, but with information displayed in page-by-page mode. arp -a > macaddr.txt— display a table of correspondence between IP and MAC addresses for a given computer with the results output to the text file macaddr.txt. Example of ARP table contents: Interface: 127.0.0.1 - 0x1 224.0.0.22 static Interface: 192.168.1.133 - 0x1c Internet address Physical address Type 192.168.1.1 c8-2b-35-9a-a6-1e dynamic This example contains ARP entries for the loopback interface 127.0.0.1 and real 192.168.1.133 . The loopback interface is not used for actual data transfer and is not bound to a hardware address. The real interface ARP table contains entries for hosts with addresses 192.168.1.1 And 192.168.1.132 , as well as entries for broadcast (MAC address is ff-ff-ff-ff-ff-ff) and multicast (MAC address starts with 01-00-5e). The multicast MAC address always starts with a 24-bit prefix - 01-00-5E. The next, 25th bit is 0. The last 23 bits of the MAC address are formed from the 23 least significant bits of the group IP address. arp -s 192.168.1.1 00-08-00-62-F6-19— add an entry to the ARP table that matches the IP address 192.168.1.1 and the physical address 00-08-00-62-F6-19 arp -d 192.168.1.1— remove an entry from the ARP table for the IP address 192.168.1.1 arp -d 192.168.1.*— remove entries from the ARP table for the range of IP addresses 192.168.1.1 - 192.168.1.254 Some notes on practical use of the ARP command: — address resolution via the ARP protocol is performed only during operations transfers data via IP protocol. Examples of practical use of ARP for network diagnostics. Full list of CMD Windows commands |
ARP protocol
In this section, we'll look at how the destination Ethernet address is determined when an IP packet is sent. To map IP addresses to Ethernet addresses, the ARP (Address Resolution Protocol) protocol is used. Mapping is performed only for IP packets that are sent, since the IP and Ethernet headers are created only at the moment of sending.
ARP table for address translation
Address translation is performed by searching the table. This table, called the ARP table, is stored in memory and contains rows for each host on the network. Two columns contain IP and Ethernet addresses. If you need to convert an IP address to an Ethernet address, the entry with the corresponding IP address is searched. Below is an example of a simplified ARP table.
| IP address | Ethernet address |
|---|---|
| 223.1.2.1 223.1.2.3 223.1.2.4 |
08:00:39:00:2F:C3 08:00:5A:21:A7:22 08:00:10:99:AC:54 |
Table 1. Example ARP table
It is customary to write all bytes of a 4-byte IP address as dotted decimal numbers. When writing a 6-byte Ethernet address, each byte is specified in hexadecimal and is separated by a colon.
The ARP table is necessary because IP addresses and Ethernet addresses are chosen independently, and there is no algorithm for converting one to the other. The IP address is selected by the network manager taking into account the machine’s position on the Internet. If a machine is moved to another part of the internet, its IP address must be changed. The Ethernet address is selected by the manufacturer of the network interface equipment from the address space allocated for it under the license. When a machine's network adapter card is replaced, its Ethernet address also changes.
Address translation order
During normal operation, a network program such as TELNET sends an application message using TCP transport services. The TCP module sends the corresponding transport message through the IP module.
ARP protocol
The result is an IP packet that must be sent to the Ethernet driver. The destination IP address is known to the application program, the TCP module, and the IP module. Based on this, you need to find the Ethernet address of the destination. An ARP table is used to determine the desired Ethernet address.
ARP Requests and Responses
How is the ARP table filled? It is filled in automatically by the ARP module as needed. When an existing ARP table fails to resolve an IP address, the following occurs:
Each network adapter receives broadcasts. All Ethernet drivers check the type field in the received Ethernet frame and forward ARP packets to the ARP module. An ARP request can be interpreted as follows: “If your IP address matches the one listed, then please tell me your Ethernet address.” The ARP request packet looks something like this:
Table 2. Example of an ARP Request Each ARP module checks the searched IP address field in the received ARP packet and, if the address matches its own IP address, it sends a response directly to the Ethernet address of the requester. The ARP response can be interpreted as follows: “Yes, this is my IP address, such and such an Ethernet address corresponds to it.” The ARP response packet looks something like this:
Table 3. Example of an ARP response This response is received by the machine that made the ARP request. The driver of this machine checks the type field in the Ethernet frame and passes the ARP packet to the ARP module. The ARP module parses the ARP packet and adds an entry to its ARP table.
The updated table looks like this:
| IP address | Ethernet address |
|---|---|
| 223.1.2.1 223.1.2.2 223.1.2.3 223.1.2.4 |
08:00:39:00:2F:C3 08:00:28:00:38:A9 08:00:5A:21:A7:22 08:00:10:99:AC:54 |
Table 4. ARP table after response processing
Continue Address Translation
A new entry in the ARP table appears automatically, a few milliseconds after it is required. As you remember, earlier in step 2 the outgoing IP packet was queued. Now, using the updated ARP table, the IP address is translated into an Ethernet address, after which the Ethernet frame is transmitted over the network. The complete order of address conversion looks like this:
- An ARP request is broadcast across the network.
- The outgoing IP packet is queued.
- An ARP response is returned containing information about the correspondence between the IP and Ethernet addresses. This information is entered into the ARP table.
- An ARP table is used to convert an IP address to an Ethernet address for a queued IP packet.
- An Ethernet frame is transmitted over an Ethernet network.
In short, if the ARP table cannot immediately translate addresses, then the IP packet is queued, and the information necessary for translation is obtained using ARP requests and responses, after which the IP packet is sent to its destination.
If there is no machine on the network with the required IP address, then there will be no ARP response and there will be no entry in the ARP table. The IP protocol will discard IP packets destined for this address. Upper-level protocols cannot distinguish between the case of a damaged Ethernet network and the absence of a machine with the desired IP address.
Some IP and ARP implementations do not queue IP packets while they wait for ARP responses. Instead, the IP packet is simply discarded and its recovery is left to the TCP module or application process running over UDP. This recovery is accomplished using timeouts and retransmissions. The retransmission of the message succeeds because the first attempt has already caused the ARP table to be filled.
It should be noted that each machine has a separate ARP table for each of its network interfaces.
Proxy-ARP is a technology according to which a router responds to someone else's ARP request, which is not intended for it, with its MAC address.
In this case, the sender, assuming that it received the recipient’s physical address in the ARP response, places this MAC address in the frame. Thus, the router receives a frame addressed to it, but the packet does not contain its IP address. This in turn means that the packet is intended to be routed. The response packet also goes through the reverse routing stage. The router is transparent to both sides.
It is possible that proxy-arp works only for one network segment, but on the other side the host knows about the existence of the router and sends packets to it deliberately.
Problems that this technology allows to solve:
- connecting to the network of one host belonging to a different physical network (different broadcast domain)
- combining two broadcast domains for unicast communication, but limiting broadcast traffic between domains; without resorting to the use of bridges and firewalls.
The concept of Proxy-ARP can be found when configuring a VPN server.
In Frame-Relay technology there is the concept of Inverse-ARP. As its name suggests, this protocol is reverse ARP.
Address Resolution Protocol
The essence of the protocol is to convert a physical address into a logical one, i.e. IP address. In a Frame-Relay network, the physical address is the DLCI.
Thanks for the article: Dmitry Podgorny
Clearing and deleting the ARP cache
Clearing the ARP cache via the command line
When computers access DNS information, the name and address mappings found are temporarily stored in an ARP (Address Resolution Protocol) cache so that the next time the same information is accessed, the search does not have to be done again. This information ages according to the TTL (Time-To-Live) value set when it is received, and at the end of its lifetime, such information must be updated.
When new information is received, a new TTL value is set. In general, this automatic system for retrieving, cleaning, and updating name-address mapping information works well.
ARP command - View and modify ARP tables.
But sometimes outdated information manages to cause problems before it is reset. So, if the DNS name on a computer changes and the TTL value has not yet been reset, you will temporarily lose the ability to find that computer.
Removing old name mapping information
DNS administrators have a few tricks up their sleeves that can help reduce the negative impact of name changes, such as setting a lower TTL before changing the name so that old information is deleted faster and doesn't cause problems. However, you may find that it's easier to simply get rid of the old data and have your computer look up the DNS information again.
To do this, enter on the command line or delete arpcache(if the Interface IP context in Netsh is already installed). This will remove name and address mapping information for all interfaces configured on this computer.
Example of using clear arp cache
If you have several interfaces and you want to reset information for only one interface, specify the desired interface using InterfaceName, for example:
- netsh interface ip delete arpcache
- delete arpcache
ARP(Address Resolution Protocol) is a network layer protocol (Network Link layer) designed to convert IP addresses (network layer addresses) to MAC addresses (link layer addresses) in TCP/IP networks. It is defined in RFC 826.
arp utility:
Console utility switches arp:arp -a displays the contents of the ARP table. arp
arp protocol
arp -d-a deletes all table entries. arp -s
In Linux, it is impossible to completely clear the ARP table using standard tools. You can use a script like this, modifying it accordingly to suit your needs ethers.local #!/bin/shI=1while[$I-le254]do arp -d 192.168.1.$(I) arp -s 192.168.1.$(I )0:0:0:0:0:0I=`expr$I + 1`done arp -f/etc/ethers.local
Routing.
This command sets all status items to failed. Subsequently, the operating system kernel will remove the marked MAC addresses. ip neigh flush all
Rating: 4.86 Votes: 7 Comments: 10
Let's start with the theory...
What is ARP and why do we need it?
ARP(“Address Resolution Protocol” - address determination protocol) is a low-level protocol used in computer networks, designed to determine the link layer address from a known network layer address. This protocol has become most widespread due to the ubiquity of IP networks built on top of Ethernet, since in almost 100% of cases ARP is used with this combination.
The ARP protocol works with MAC addresses. Each network card has its own individual MAC address.
MAC address (“Media Access Control” - media access control) is a unique identifier associated with different types of computer networking equipment. Most link-layer network protocols use one of three MAC address spaces managed by IEEE: MAC-48, EUI-48, and EUI-64. Addresses in each space should theoretically be globally unique. Not all protocols use MAC addresses, and not all protocols that use MAC addresses need these addresses to be so unique.
Fig.1. Path to the ARP table.
Fig.2. ARP table.
In Figure 2 we see the ARP table. It contains three entries, they are added automatically and have the following structure. IP Address– this is, in fact, the IP address of the network computer, MAC Address– this is the mac address of the same computer, and interface, which indicates which interface this computer is located on. Please note that in front of all entries there is a letter D. This means that this entry is dynamic and will be changed if any data changes. That is, if the user accidentally enters the wrong IP address, the entry in the ARP table will simply change and nothing else. But this doesn't suit us. We need to insure ourselves against such cases. To do this, static entries are added to the ARP table. How to do it? There are two ways.
Fig.3. We add a Static record in the first way.
Method one. As usual, press the red plus. In the window that appears, enter the IP address, MAC address and select the interface behind which this computer is located.
Fig.4. We add a Static record in the second way.
Method two. Select the desired entry, double-click with the left mouse button, and in the window that appears, press the button Make Statik. Static entry added.
Fig.5. Table with static records.
As you can see in Figure 5, there is no letter D opposite the added entry. This indicates that the entry is static.
Now, if the user accidentally enters an address that is not his own, Mikrotik, having checked the correspondence of the IP and MAC addresses in the ARP table and not finding the required entry, will not allow the user to access the Internet, thereby leading the user to believe that he may have been is wrong and you should call the administrator.
What else would I like? draw your attention e: these entries are used for packets passing through the router.
Router or router- a network device that makes decisions about forwarding network layer packets (layer 3 of the OSI model) between different network segments based on information about the network topology and certain rules.
If you want the rules to apply to the Bridge, then you need to enable the Use IP Firewall function in Bridge (Fig. 6.).
Bridge is a way to connect two Ethernet segments at the data link level, i.e. without using higher level protocols such as IP. Packets are transmitted based on Ethernet addresses rather than IP addresses (as in a router). Because transmission occurs at the data link layer (OSI Layer 2), all higher-layer protocols pass transparently through the bridge.
Fig.6. Enabling the Use IP Firewall function.
Evgeniy Rudchenko
Previously it was said that the port or interface through which the router is connected to the network is considered part of that network. Therefore, the router interface connected to the network has the same IP address as the network (Figure 6.12). Because routers, like any other device, receive and send data over a network, they also build ARP tables that contain mappings from IP addresses to MAC addresses.
Figure 6.11. The RARP server responds to an IP request from a workstation with MAC address 08-00-20-67-92-89
Figure 6.12. IP addresses are mapped to MAC addresses using ARP tables.
A router can be connected to multiple networks or subnets. In general, network devices have sets of only those MAC and IP addresses that are regularly repeated. In short, this means that a typical device contains information about the devices on its own network. However, very little is known about devices outside of their own local network. At the same time, the router builds tables describing all the networks connected to it. As a result, routers' ARP tables can contain the MAC and IP addresses of devices on more than one network (6.13). In addition to maps of correspondence between IP addresses and MAC addresses, the router tables contain a mapping of ports (Fig. 6.14)
What happens if a data packet reaches a router that is not connected to the packet's destination network? In addition to the MAC and IP addresses of devices on the networks to which this router is connected, it also contains the MAC and IP addresses of other routers. The router uses these addresses to forward data to the final recipient (Fig. 6.15). When a router receives a packet whose destination address is not in the routing table, the router forwards the packet to the addresses of other routers, which may contain information about the destination host in their routing tables.
Figure 6.14. Ports are also entered into the routing table
Default Gateway
If the source is located on a network with a number that is different from the destination network number, and the source does not know the MAC address of the recipient, then in order to deliver the data to the recipient, the source must use the services of a router. If a router is used in this way, it is called default gateway. To use the default gateway, the source encapsulates the data by placing the router's MAC address as the destination MAC address. Since the source wants to deliver data to the device, and not the router, the IP address of the device, not the router, is used in the header as the destination IP address (Figure 6.16). When a router receives data, it discards the link-layer information used in encapsulation. The data is then passed to the network layer where the destination IP address is analyzed. The router then compares the destination IP address with the information contained in the routing table. If a router detects a mapping from a destination IP address to a corresponding MAC address and concludes that the destination network is connected to one of its ports, it encapsulates the data with the new MAC address information and forwards it to its destination.
Figure 6.15. The data is forwarded by the router to its destination
Figure 6.16. The IP address of the destination is used to deliver data
Summary
- All devices on the local network must listen for ARP requests, but only those devices whose IP address matches the IP address contained in the request must respond by reporting their MAC address to the device that made the request.
- If the device's IP address matches the IP address contained in the ARP request, the device responds by sending its MAC address to the source. This procedure is called an ARP response.
- If the source cannot find the destination MAC address in its ARP table, it creates an ARP request and broadcasts it to all devices on the network.
- If the device does not know its own IP address, it uses the RARP protocol.
- When the device that issued the RARP request receives a response, it copies its IP address into a cache where the address will be stored for the duration of the session.
- Routers, like any other device, receive and send data over the network, so they also build ARP tables that contain mappings of IP addresses to MAC addresses.
- If the source is located on a network number that is different from the destination network number, and the source does not know the destination MAC address, then the source must use the router as the default gateway in order to deliver data to the destination.
Chapter 7 Topologies
In this chapter:
- Definition of the concept topology
- Bus topology, its advantages and disadvantages
- Star topology, its advantages and disadvantages
- External terminators
- Active and passive hubs
- Extended Star Topology Characteristics, Definition
- cable lengths for a star topology and ways to increase the size of the area covered by a network with a star topology
- Attenuation
Introduction
Chapter 6, “ARP and RARP,” showed how devices on local networks use the ARP address translation protocol before sending data to the recipient. It also looked at what happens if a device on the same network does not know the media access control address (MAC Cres) devices on another network.This chapter introduces the topologies used in creating networks.
Topology
In a local area network (LAN), all workstations must be connected to each other. If the LAN includes a file server, it must also be connected to the workstations. The physical diagram that describes the structure of a local network is called topology This chapter describes three types of topologies: bus, star and extended star (Figure 71, 72)
Figure 7.1. The bus topology is typical of an Ethernet LAN, including 10Base2 and 10BaseS
Figure 7.2. A star topology is typical for Ethernet and Token Ring networks, which use a hub, switch, or repeater as the center of the network.
Bus topology
A bus topology is a topology in which all LAN devices are connected to a linear network data transmission medium. This linear medium is often called a channel, bus, or trace. Each device, for example, a workstation or server, is independently connected to a common bus cable using a special connector (Fig. 7.3). The bus cable must have a termination resistor, or terminator, at the end, which absorbs the electrical signal, preventing it from being reflected and moving in the opposite direction along the bus.
ARP(Address Resolution Protocol- address determination protocol) is a protocol in computer networks designed to determine the MAC address from a known IP address. This example shows how to obtain the ARP table of a local computer. To do this, use the property " StandardOutput" from the class " Process", which allows you to get the stream used to read the application's output. The command line is used as a data output source by running the command " arp -a", which displays the current ARP entries by querying the current protocol data. If ARPs are used on more than one network interface, then entries for each table will be displayed. public static StreamReader ExecuteCommandLine(String file, String arguments = "") ( ProcessStartInfo startInfo = new ProcessStartInfo(); //Set a value indicating the need to start //the process in a new window. startInfo.CreateNoWindow = true; //Set a hidden window style A window can be visible or hidden. //The system displays a hidden window without drawing it. //If a window is hidden, it is effectively disabled. //A hidden window can process messages from the system or //from other windows, but cannot process input from the user //or display output. Often, an application can keep the new window //hidden while the application determines the window's appearance, and then //set the window style to Normal. startInfo.WindowStyle = ProcessWindowStyle.Hidden; //Set a value indicating that you don't need to // use the operating system shell to start the process startInfo.UseShellExecute = false; //Set a value indicating whether to write the application // output to the System.Diagnostics.Process.StandardOutput stream. startInfo.RedirectStandardOutput = true; //Set the application to launch. startInfo.FileName = file; //Set a set of command line arguments used when //launching the application. startInfo.Arguments = arguments; //Set the preferred encoding for standard output. startInfo.StandardOutputEncoding = Encoding.GetEncoding(866); //Launch the process resource with the above parameters and associate //the resource with the new component System.Diagnostics.Process. Process process = Process.Start(startInfo); //Return a System.IO.StreamReader that can be used //to read the application's standard output stream. return process.StandardOutput; ) To use the above method and parse the resulting data, add the listing below to the " Form_Load" main form or in the method " Button_Click» control « Button».
//Initialize a new table DataTable dt = new DataTable(); //Create three columns dt.Columns.Add("Internet address"); dt.Columns.Add("Physical Address"); dt.Columns.Add("Type"); //Insert the data stream from the console application into a variable var arpStream = WindowsFormsARPTable.Form1.ExecuteCommandLine("arp", "-a"); //Delete the first three lines, because they contain //an empty line //interface name //column headers for (int i = 0; i< 3; i++)
{
arpStream.ReadLine();
}
//Циклически проходим по входному потоку
//Пока функция EndOfStream не вернет значение true
//указывающая, что текущая позиция потока
//находится в конце потока
while (!arpStream.EndOfStream)
{
//Получаем одну строку из текущего потока
var line = arpStream.ReadLine().Trim();
//Так как между столбцами есть несколько пробелов
//их необходимо сократить до одного
while (line.Contains(" "))
{
line = line.Replace(" ", " ");
}
//Чтобы распределить полученные данные по столбцам таблицы их
// необходимо разделить с помощью метода Split
// который возвращает массив, элементы которого содержат
//подстроки данного экземпляра, разделенные одним или более
//знаками указанных в его значении.
var parts = line.Split(" ");
//Если значение первого столбца пустое, значит
//данную строку необходимо пропустить
if (parts.Trim() != string.Empty)
{
//Если первое значение не пустое
//создаем строку с использованием трех параметров и
//добавляем его в System.Data.DataRowCollection.
dt.Rows.Add(new object
{
parts.Trim(),
parts.Trim(),
parts.Trim()
});
}
}
Below is an example of how the test program works.
TCP/IP does not consider link and physical layer technologies; during actual data transfer, you still have to map the IP address to the link layer address.
An Ethernet network uses IP and MAC addresses to identify the source and destination of information. Information sent from one computer to another over a network contains the sender's physical address, the sender's IP address, the recipient's physical address, and the recipient's IP address. ARP provides communication between these two addresses because the two addresses are not related to each other in any way.
ARP- Address Resolution Protocol is a protocol of the third (network) layer of the OSI model, used to convert IP addresses to MAC addresses, plays an important function in multiple access networks. ARP was defined by RFC 826 in 1982.
Direct communication between an IP address and a MAC address is carried out using so-called ARP tables, where each line indicates the correspondence of the IP address to the MAC address.
An example of an ARP table in Windows OS is shown in the figure.
In the ARP table, in addition to the IP and MAC address, the type of connection is also indicated; there are two types of entries:
- Static entries are created manually and last as long as the computer or router remains turned on.
- Dynamic records must be updated periodically. If a record has not been updated within a certain time (approximately 2 minutes), then it is excluded from the table. The ARP table does not contain entries about all network nodes. But only those who actively participate in network operations. This storage method is called an ARP cache.
In IPv6, ARP functionality is provided by the protocol NDP(Neighbor Discovery Protocol).
RARP(English: Reverse Address Resolution Protocol) is a protocol of the third (network) layer of the OSI model, performs reverse address mapping, that is, converts the hardware address into an IP address.
There are four types of ARP messages:
- ARP request(ARPrequest);
- ARP reply;
- RARP-request;
- RARP-reply.
ARP header structure
- Hardware type (HTYPE) Each channel data transfer protocol has its own number, which is stored in this field. For example, Ethernet is number 0x0001
- Protocol type (PTYPE) Network protocol code. For example, for IPv4 it will be written 0x0800
- Hardware length (HLEN) Length of the physical address in bytes. Ethernet addresses are 6 bytes long.
- Protocol length (PLEN) Length of the logical address in bytes. IPv4 addresses are 4 bytes long.
- Operation Sender's operation code: 1 in case of request and 2 in case of response.
- Sender hardware address (SHA) The physical address of the sender.
- Sender protocol address (SPA) Logical address of the sender.
- Targethardwareaddress (THA) The recipient's physical address. The field is empty when requested.
- Target protocol address (TPA) Logical destination address.
Let's look at the structure of the ARP request header using the example of an intercepted packet using the Wireshark network analyzer
Let's look at the structure of the ARP response header (reply) using the example of an intercepted packet using the Wireshark network analyzer